2 ms·
I agree -- the tone of the article was cloak-and-daggers, which makes me think things are not what they seem they are. Unless we fully understand the exact set
by whydoyoucare 7y ago
I agree -- the tone of the article was cloak-and-daggers, which makes me think things are not what they seem they are. Unless we fully understand the exact set of issues, it is difficult to decide either way.
Sadly, this also undermines trust in the overall state of "security research", which most of the time, borders on being silly. :-/
- tptacek 7y agoThis is on the more-competent end of the spectrum of bounty submissions, for what it's worth. Because the median bounty submission is very, very bad. These people at least appear to have done some actual work. Paypal is probably one of the most overfished ponds in application security, and they didn't come up with much, but it's at least sort of interesting.